How it works Operators Audit log Request early access

Secret rotation, done as a transaction

Rotate every secret. Break nothing.

Kleides proves where a credential lives, replaces it everywhere, confirms that every consumer has picked up the new value, and only then destroys the old one. If any step fails, it stops with both keys still working and tells a human why.

Request early access Read a sample audit log →

Doppler · Fly.io · GitHub Actions · AWS

kleides

KLAY-des

Greek for “keys”

rotation · resend / production API key

Sample

1 · Locate

Found in Doppler, Fly.io and GitHub Actions. Nothing else holds it.

2 · Replace

New key issued at Resend and written to all three places. Old key left valid.

3 · Confirm

Every consumer reports the new value in use.

4 · Destroy · waiting for your approval

Approval sent to your phone. The old key is not touched until you say so.

Both keys valid until step 4.

How it works

Every rotation is a transaction.

A rotation either completes in full or leaves things as they were. There is no half-rotated state that someone has to untangle at night.

01

Prove

Before anything changes, Kleides proves where the credential lives, in every store and every consumer.

02

Replace

A new credential is issued and written everywhere the old one was. The old one keeps working.

03

Confirm

Every consumer must show it has picked up the new value. Silence is not confirmation.

04

Destroy

Only now is the old credential revoked at the issuer. Nothing earlier, nothing on a guess.

If any step fails

Kleides rolls back, or stops safely with both keys still working, and tells a human exactly why.

Built for small teams

Where your keys are kept, and who issues them.

Kleides works at both ends: it replaces the credential at the issuer, and in every place your systems read it from.

Kept in

Doppler

Fly.io

GitHub Actions

AWS

Issued by

AWS

Resend

Cloudflare

Doppler

Custody

No one who coordinates a rotation ever sees the secret.

Values are escrowed encrypted and shredded after use. Not the people running the rotation, and not the systems coordinating it, ever see a value.

Issued

The provider creates the new credential.

Escrowed, encrypted

Held sealed. Coordinators handle references, not values.

Delivered

Written straight to each store that needs it.

Shredded

The escrowed copy is destroyed once it has been used.

Operators

You stay in control, at every step.

Approval from your phone

A rotation can wait for a yes before it destroys anything. The request arrives as a notification.

A kill switch

Pause everything, even mid-flight. Rotations stop where both keys still work.

Drills

Prove that every credential can actually be rotated, before the day you need it to be.

Shadow mode

Watch production read-only. Kleides reports drift, orphaned secrets, and keys nobody rotates.

Audit log

Every decision, with its reason.

Entries are chained so that any alteration shows. Replay a rotation as a timeline in plain language, and read what happened without reading logs.

Timeline · resend production key

Sample

01

Found the key in three places. Doppler, Fly.io and GitHub Actions all held it.

02

Issued a new key at Resend and left the old key valid, so nothing could break.

03

Fly.io had not yet picked up the new value. Waited, then checked again.

04

Every consumer confirmed. Holding the old key until you approve its destruction.

Chain intact. No entry altered.

Know that every key can be changed.

Start in shadow mode. Kleides watches, reports, and changes nothing until you tell it to.

Request early access

kleides KLAY-des

kleides.dev · Greek for “keys”